Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61793— Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Quick assessment

Affected
nuxt-modules og-image
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt OG Image 是一个用于在 Nuxt 中通过 Vue 模板生成 OG 图片的工具。在版本 6.0.2 至 6.7.0 中，当使用文档中推荐的默认安全配置 和 时，nuxt-og-image 会暴露未认证的 路由。攻击者可以通过 对 参数进行 base64url 解码，并控制 的值。这些值会流经 进入 绑定模块，该模块在执行服务器端 fetch 请求时，未对 URL 协议、来源、解析后的地址或重定向进行任何验证。 这使得攻击者能够向回环地址、私有网络地址、链路本地地址、云元数据服务以及其他内部 HTTP

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61793

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nuxt-modules og-image >= 6.0.2, < 6.7.0 -

II. Public POCs for CVE-2026-61793

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61793

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61793 (2)

Vendor Advisories for CVE-2026-61793 (1)

Vendor Pages for CVE-2026-61793 (1)

IV. Related Vulnerabilities

Same product: og-image
Same vendor: nuxt-modules
Same weakness: CWE-20

V. Comments for CVE-2026-61793

No comments yet

Leave a comment